Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb.zip
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Jsreceipt0193617_pdf.js
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
Jsreceipt0193617_pdf.js
Resource
win10v2004-20230703-en
General
-
Target
Jsreceipt0193617_pdf.js
-
Size
300.0MB
-
MD5
7108c34a9356846f77c1e827b412ff1a
-
SHA1
6d2fffdb1f4bb4d4d6c718591b5a23f5991dfcec
-
SHA256
ef0bad7386e17039dc9a15a4dc29f46c8c6db9ccdfd8ca75b6970969dbce7402
-
SHA512
e24cada2a7016f22203f70fbcf3a3062d661902a80ccad10d3be54c534df29102f18ec5b3485881f98f8f52abf92a9292c59d56497ab6e97f1572042510f6adf
-
SSDEEP
192:mZVhrK1X92Z2ZW3oGDZDE8k324K/5gJx/I8Dg:wV81cSEWzZM
Malware Config
Extracted
vjw0rm
http://jsnew9400.duckdns.org:9400
Signatures
-
Blocklisted process makes network request 19 IoCs
flow pid Process 2 216 wscript.exe 4 216 wscript.exe 5 216 wscript.exe 6 216 wscript.exe 7 216 wscript.exe 8 216 wscript.exe 9 216 wscript.exe 10 216 wscript.exe 11 216 wscript.exe 12 216 wscript.exe 13 216 wscript.exe 14 216 wscript.exe 15 216 wscript.exe 16 216 wscript.exe 17 216 wscript.exe 18 216 wscript.exe 19 216 wscript.exe 20 216 wscript.exe 21 216 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jsreceipt0193617_pdf.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS8ABDCUZM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Jsreceipt0193617_pdf.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).